The existing restriction for the `hash` attribute setter makes little sense, as you can still set `search`, `username`, etc.